@consilioweb/payload-support 2.0.1 → 4.0.0

package/dist/views/shared/Skeleton.d.ts

@@ -0,0 +1,21 @@
+import React from 'react';
+interface SkeletonProps {
+    width?: string | number;
+    height?: string | number;
+    borderRadius?: string;
+    style?: React.CSSProperties;
+}
+export declare function Skeleton({ width, height, borderRadius, style }: SkeletonProps): React.JSX.Element;
+export declare function SkeletonText({ lines, width }: {
+    lines?: number;
+    width?: string | number;
+}): React.JSX.Element;
+export declare function SkeletonCard({ height }: {
+    height?: string;
+}): React.JSX.Element;
+export declare function SkeletonTable({ rows, columns }: {
+    rows?: number;
+    columns?: number;
+}): React.JSX.Element;
+export declare function SkeletonDashboard(): React.JSX.Element;
+export {};

package/dist/views/shared/StatusPill.d.ts

@@ -0,0 +1,8 @@
+import React from 'react';
+export type TicketStatusVariant = 'open' | 'pending' | 'waiting_client' | 'resolved' | 'closed' | 'escalated' | 'sla-breach';
+export interface StatusPillProps {
+    status: TicketStatusVariant | string;
+    label?: string;
+    className?: string;
+}
+export declare const StatusPill: React.FC<StatusPillProps>;

package/dist/views/shared/adminTokens.d.ts

@@ -0,0 +1,19 @@
+import type React from 'react';
+export declare const V: {
+    readonly text: "var(--theme-text)";
+    readonly textSecondary: "var(--theme-elevation-500)";
+    readonly bg: "var(--theme-elevation-50)";
+    readonly bgCard: "var(--theme-elevation-100)";
+    readonly border: "var(--theme-elevation-300)";
+    readonly blue: "#2563eb";
+    readonly amber: "#d97706";
+    readonly orange: "#ea580c";
+    readonly green: "#16a34a";
+    readonly red: "#dc2626";
+    readonly cyan: "#2563eb";
+    readonly yellow: "#d97706";
+};
+export declare const btnStyle: (bg: string, opts?: {
+    disabled?: boolean;
+    small?: boolean;
+}) => React.CSSProperties;

package/dist/views/shared/config.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Ticketing feature flags — re-export of the shared implementation.
+ *
+ * See `utils/features.ts`. This module is kept so that
+ * `views/shared/index.ts` and existing view imports keep resolving.
+ */
+export { DEFAULT_TICKETING_FEATURES, DEFAULT_TICKETING_FEATURES as DEFAULT_FEATURES, FEATURES_CACHE_KEY, fetchFeatures, getFeatures, normalizeFeatures, saveFeatures, } from '../../utils/features.js';
+export type { TicketingFeatures } from '../../utils/features.js';

package/dist/views/shared/config.js

@@ -1,40 +1 @@
-const DEFAULT_FEATURES = {
-  timeTracking: true,
-  ai: true,
-  satisfaction: true,
-  chat: true,
-  emailTracking: true,
-  canned: true,
-  merge: true,
-  snooze: true,
-  externalMessages: true,
-  clientHistory: true,
-  activityLog: true,
-  splitTicket: true,
-  scheduledReplies: true,
-  autoClose: true,
-  autoCloseDays: 7,
-  roundRobin: false
-};
-const STORAGE_KEY = "ticketing_features";
-function getFeatures() {
-  if (typeof window === "undefined") return DEFAULT_FEATURES;
-  try {
-    const stored = localStorage.getItem(STORAGE_KEY);
-    if (stored) {
-      const parsed = JSON.parse(stored);
-      return { ...DEFAULT_FEATURES, ...parsed };
-    }
-  } catch {
-  }
-  return DEFAULT_FEATURES;
-}
-function saveFeatures(features) {
-  if (typeof window === "undefined") return;
-  try {
-    localStorage.setItem(STORAGE_KEY, JSON.stringify(features));
-  } catch {
-  }
-}
-
-export { DEFAULT_FEATURES, getFeatures, saveFeatures };
+export { DEFAULT_TICKETING_FEATURES as DEFAULT_FEATURES, DEFAULT_TICKETING_FEATURES, FEATURES_CACHE_KEY, fetchFeatures, getFeatures, normalizeFeatures, saveFeatures } from '../../utils/features.js';

package/dist/views/shared/dateLocale.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Default date locale constant for formatting functions.
+ * Extracted from user preferences at runtime when available.
+ */
+export declare const DATE_LOCALE = "fr-FR";

package/dist/views/shared/index.d.ts

@@ -0,0 +1,12 @@
+export { AdminErrorBoundary } from './ErrorBoundary.js';
+export { V, btnStyle } from './adminTokens.js';
+export { AdminViewHeader } from './AdminViewHeader.js';
+export { Skeleton, SkeletonText, SkeletonCard, SkeletonTable, SkeletonDashboard } from './Skeleton.js';
+export { getFeatures, saveFeatures, fetchFeatures, normalizeFeatures, DEFAULT_FEATURES } from './config.js';
+export type { TicketingFeatures } from './config.js';
+export { useFeatures } from '../../components/TicketConversation/hooks/useFeatures.js';
+export type { UseFeaturesResult } from '../../components/TicketConversation/hooks/useFeatures.js';
+export { StatusPill } from './StatusPill.js';
+export type { StatusPillProps, TicketStatusVariant } from './StatusPill.js';
+export { computeSlaState, formatSlaRemaining } from './sla.js';
+export type { SlaState } from './sla.js';

package/dist/views/shared/index.js

@@ -2,6 +2,7 @@ export { AdminErrorBoundary } from './ErrorBoundary.js';
 export { V, btnStyle } from './adminTokens.js';
 export { AdminViewHeader } from './AdminViewHeader.js';
 export { Skeleton, SkeletonCard, SkeletonDashboard, SkeletonTable, SkeletonText } from './Skeleton.js';
-export { DEFAULT_FEATURES, getFeatures, saveFeatures } from './config.js';
+export { DEFAULT_FEATURES, fetchFeatures, getFeatures, normalizeFeatures, saveFeatures } from './config.js';
+export { useFeatures } from '../../components/TicketConversation/hooks/useFeatures.js';
 export { StatusPill } from './StatusPill.js';
 export { computeSlaState, formatSlaRemaining } from './sla.js';

package/dist/views/shared/sla.d.ts

@@ -0,0 +1,14 @@
+export type SlaState = 'ok' | 'warn' | 'breach' | 'none' | 'met';
+export interface SlaInput {
+    slaFirstResponseDue?: string | null;
+    slaFirstResponseBreached?: boolean | null;
+    firstResponseAt?: string | null;
+    slaResolutionDue?: string | null;
+    slaResolutionBreached?: boolean | null;
+}
+export declare function computeSlaState(t: SlaInput, now?: Date): {
+    state: SlaState;
+    remainingMs: number | null;
+    due: string | null;
+};
+export declare function formatSlaRemaining(remainingMs: number | null): string;

package/dist/views.d.ts

@@ -1,13 +1,13 @@
-export { default as TicketInboxView } from './views/TicketInboxView/index';
-export { default as TicketDetailView } from './views/TicketDetailView/index';
-export { default as SupportDashboardView } from './views/SupportDashboardView/index';
-export { default as NewTicketView } from './views/NewTicketView/index';
-export { default as TicketingSettingsView } from './views/TicketingSettingsView/index';
-export { default as LogsView } from './views/LogsView/index';
-export { default as ChatView } from './views/ChatView/index';
-export { default as CrmView } from './views/CrmView/index';
-export { default as PendingEmailsView } from './views/PendingEmailsView/index';
-export { default as EmailTrackingView } from './views/EmailTrackingView/index';
-export { default as BillingView } from './views/BillingView/index';
-export { default as TimeDashboardView } from './views/TimeDashboardView/index';
-export { default as ImportConversationView } from './views/ImportConversationView/index';
+export { default as TicketInboxView } from './views/TicketInboxView/index.js';
+export { default as TicketDetailView } from './views/TicketDetailView/index.js';
+export { default as SupportDashboardView } from './views/SupportDashboardView/index.js';
+export { default as NewTicketView } from './views/NewTicketView/index.js';
+export { default as TicketingSettingsView } from './views/TicketingSettingsView/index.js';
+export { default as LogsView } from './views/LogsView/index.js';
+export { default as ChatView } from './views/ChatView/index.js';
+export { default as CrmView } from './views/CrmView/index.js';
+export { default as PendingEmailsView } from './views/PendingEmailsView/index.js';
+export { default as EmailTrackingView } from './views/EmailTrackingView/index.js';
+export { default as BillingView } from './views/BillingView/index.js';
+export { default as TimeDashboardView } from './views/TimeDashboardView/index.js';
+export { default as ImportConversationView } from './views/ImportConversationView/index.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@consilioweb/payload-support",
-  "version": "2.0.1",
+  "version": "4.0.0",
   "description": "Payload CMS plugin — professional support & ticketing system with AI, SLA, time tracking, live chat, and more",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -31,14 +31,11 @@
       "import": {
         "types": "./dist/views.d.ts",
         "default": "./dist/views.js"
-      },
-      "require": {
-        "types": "./dist/views.d.cts",
-        "default": "./dist/views.cjs"
       }
     },
     "./components/TicketConversation": {
       "import": {
+        "types": "./dist/components/TicketConversation/index.d.ts",
         "default": "./dist/components/TicketConversation/index.js"
       }
     }
@@ -46,6 +43,9 @@
   "files": [
     "dist",
     "src",
+    "!src/__tests__",
+    "!src/**/*.test.ts",
+    "!src/**/*.test.tsx",
     "README.md",
     "LICENSE"
   ],
@@ -85,34 +85,19 @@
   "author": "ConsilioWEB <contact@consilioweb.fr> (https://consilioweb.fr)",
   "license": "MIT",
   "peerDependencies": {
-    "@payloadcms/next": "^3.0.0",
-    "@payloadcms/translations": "^3.0.0",
-    "@payloadcms/ui": "^3.0.0",
+    "@payloadcms/next": "^3.37.0",
     "lucide-react": ">=0.300.0",
-    "next": "^14.0.0 || ^15.0.0 || ^16.0.0",
-    "payload": "^3.0.0",
-    "react": "^18.0.0 || ^19.0.0",
-    "react-dom": "^18.0.0 || ^19.0.0"
-  },
-  "peerDependenciesMeta": {
-    "@payloadcms/ui": {
-      "optional": true
-    },
-    "@payloadcms/translations": {
-      "optional": true
-    },
-    "@payloadcms/next": {
-      "optional": true
-    },
-    "lucide-react": {
-      "optional": true
-    },
-    "next": {
-      "optional": true
-    }
+    "next": "^15.2.9 || ^16.0.0",
+    "payload": "^3.37.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20.9.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
   },
   "devDependencies": {
     "@payloadcms/db-sqlite": "^3.86.0",
@@ -142,7 +127,7 @@
     "web-push": "^3.6.7"
   },
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && tsc -p tsconfig.types.json && node scripts/copy-subpath-types.mjs",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",

package/src/collections/ChatMessages.ts

@@ -1,5 +1,56 @@
-import type { CollectionConfig } from 'payload'
+import { APIError } from 'payload'
+import type { CollectionBeforeChangeHook, CollectionConfig } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
+import { dbFind } from '../utils/db'
+
+/**
+ * Cross-tenant write guard for support-clients.
+ *
+ * `access.create` used to be `!!req.user`, which any principal of ANY auth
+ * collection satisfies — including a front-office member of the host app. With
+ * no hook validating the row, an attacker could POST a message attributed to
+ * someone else's `client` and flagged `senderType: 'agent'` with an arbitrary
+ * `agent` relation: the agent console and the targeted client both render it as
+ * a genuine conversation (phishing over a trusted channel).
+ *
+ * Mirrors `createRestrictClientTicketTarget` on ticket-messages: the client's
+ * own identity is FORCED onto the row instead of being trusted from the body.
+ * Internal writers (endpoints/chat.ts, endpoints/admin-chat.ts,
+ * collections/TicketMessages.ts) all write with `overrideAccess: true` and carry
+ * no support-client user, so they are untouched.
+ */
+function createRestrictClientChatWrite(slugs: CollectionSlugs): CollectionBeforeChangeHook {
+  return async ({ data, req }) => {
+    if (req.user?.collection !== slugs.supportClients) return data
+    data.client = req.user.id
+    data.senderType = 'client'
+    delete data.agent
+
+    // …and the SESSION has to be theirs too. Forcing `client` alone still let a
+    // client drop a line INTO someone else's conversation: the agent console
+    // loads a thread by session id with `overrideAccess: true`
+    // (endpoints/admin-chat.ts), so the injected message surfaces in the target's
+    // thread even though `access.read` hides it from the target themselves.
+    // Session ids are 16 random bytes, so this is depth rather than a reachable
+    // hole — and it costs one indexed lookup on a path no internal writer takes
+    // (chat.ts / admin-chat.ts write without a support-client `req`).
+    const session = typeof data.session === 'string' ? data.session : null
+    if (!session) return data
+
+    const existing = await dbFind(req.payload, slugs.chatMessages, {
+      where: { session: { equals: session } },
+      limit: 1,
+      depth: 0,
+      overrideAccess: true,
+    })
+    const owner = existing.docs[0]?.client
+    const ownerId = owner && typeof owner === 'object' ? (owner as { id?: unknown }).id : owner
+    if (ownerId !== undefined && ownerId !== null && String(ownerId) !== String(req.user.id)) {
+      throw new APIError('Session inaccessible.', 403)
+    }
+    return data
+  }
+}
 
 // ─── Collection factory ──────────────────────────────────
 
@@ -24,7 +75,10 @@ export function createChatMessagesCollection(slugs: CollectionSlugs): Collection
         }
         return false
       },
-      create: ({ req }) => !!req.user,
+      // Staff and support-clients only — NOT "any authenticated principal":
+      // a user of any other auth collection of the host app satisfied `!!req.user`.
+      create: ({ req }) =>
+        req.user?.collection === slugs.users || req.user?.collection === slugs.supportClients,
       update: ({ req }) => req.user?.collection === slugs.users,
       delete: ({ req }) => req.user?.collection === slugs.users,
     },
@@ -93,6 +147,9 @@ export function createChatMessagesCollection(slugs: CollectionSlugs): Collection
         },
       },
     ],
+    hooks: {
+      beforeChange: [createRestrictClientChatWrite(slugs)],
+    },
     timestamps: true,
   }
 }

package/src/collections/ClientSummaries.ts

@@ -122,11 +122,17 @@ export function createClientSummariesCollection(slugs: CollectionSlugs): Collect
         admin: { readOnly: true },
       },
     ],
+    // Staff-only, on the SAME source of truth as every other collection and as
+    // `requireAdmin`: `slugs.users`. The literal `'users'` this used to compare
+    // against is the DEFAULT slug, not the configured one — on a host app whose
+    // staff collection is renamed (`collectionSlugs.users: 'admins'`) it named
+    // the front-office collection instead, opening read/create/update/delete on
+    // AI-generated client intelligence to it while locking the real agents out.
     access: {
-      create: ({ req }) => req.user?.collection === 'users',
-      read: ({ req }) => req.user?.collection === 'users',
-      update: ({ req }) => req.user?.collection === 'users',
-      delete: ({ req }) => req.user?.collection === 'users',
+      create: ({ req }) => req.user?.collection === slugs.users,
+      read: ({ req }) => req.user?.collection === slugs.users,
+      update: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users,
     },
     timestamps: true,
   }

package/src/collections/SupportClients.ts

@@ -91,12 +91,33 @@ function createEnforce2FA(slugs: CollectionSlugs): CollectionBeforeLoginHook {
   }
 }
 
+/**
+ * Field-level write guard for the commercial / security fields.
+ *
+ * `access.update` on this collection intentionally lets a support-client PATCH
+ * their OWN document (the portal profile page writes firstName, phone, the
+ * notification toggles and the 2FA switch). Payload persists every other field of
+ * that same PATCH too, so without a field guard a client could self-promote
+ * (`tier`), rewrite the sales notes, or — worst — set `googleId`, which the Google
+ * OAuth callback resolves BEFORE the email and would hand them another account.
+ *
+ * Internal writers (2FA endpoints, OAuth linking, beforeLogin) all go through
+ * `overrideAccess: true`, which bypasses field access, so they are unaffected.
+ * `twoFactorEnabled` is deliberately NOT locked: it is a legitimate self-service
+ * toggle on the portal profile page.
+ */
+function createAdminOnlyFieldUpdate(slugs: CollectionSlugs) {
+  return ({ req }: { req: { user?: { collection?: string } | null } }) =>
+    req.user?.collection === slugs.users
+}
+
 // ─── Collection factory ──────────────────────────────────
 
 export function createSupportClientsCollection(
   slugs: CollectionSlugs,
   options?: { capabilities?: SupportCapabilities },
 ): CollectionConfig {
+  const adminOnlyFieldUpdate = createAdminOnlyFieldUpdate(slugs)
   return {
     slug: slugs.supportClients,
     labels: {
@@ -226,6 +247,7 @@ export function createSupportClientsCollection(
         access: {
           // Admin-only: never serialize commercial notes onto the client's own doc.
           read: ({ req }) => req.user?.collection === slugs.users,
+          update: adminOnlyFieldUpdate,
         },
         admin: {
           description: 'Notes commerciales (visible uniquement par les admins)',
@@ -235,6 +257,7 @@ export function createSupportClientsCollection(
         name: 'tier',
         type: 'select',
         label: 'Plan',
+        access: { update: adminOnlyFieldUpdate },
         options: [
           { label: 'Free', value: 'free' },
           { label: 'Basic', value: 'basic' },
@@ -248,6 +271,7 @@ export function createSupportClientsCollection(
         type: 'relationship',
         relationTo: slugs.users,
         label: 'Agent referent',
+        access: { update: adminOnlyFieldUpdate },
         admin: { position: 'sidebar' },
       },
       {
@@ -263,17 +287,20 @@ export function createSupportClientsCollection(
       {
         name: 'twoFactorCode',
         type: 'text',
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true },
       },
       {
         name: 'twoFactorExpiry',
         type: 'date',
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true },
       },
       {
         // Set by /support/2fa "verify"; gates login via the beforeLogin hook.
         name: 'twoFactorVerifiedAt',
         type: 'date',
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true },
       },
       {
@@ -281,6 +308,7 @@ export function createSupportClientsCollection(
         name: 'googleId',
         type: 'text',
         index: true,
+        access: { update: adminOnlyFieldUpdate },
         admin: { hidden: true },
       },
       {
@@ -352,6 +380,7 @@ export function createSupportClientsCollection(
         access: {
           // Admin-only: never serialize internal notes onto the client's own doc.
           read: ({ req }) => req.user?.collection === slugs.users,
+          update: adminOnlyFieldUpdate,
         },
         admin: {
           description: 'Visible uniquement par les admins',

package/src/collections/TicketCollaborators.ts

@@ -32,7 +32,12 @@ export function createTicketCollaboratorsCollection(slugs: CollectionSlugs): Col
         }
         return false
       },
-      create: ({ req }) => !!req.user,
+      // Staff only. This collection is the source of truth for
+      // resolveAccessibleTicketIds(), which widens `read` on tickets, messages
+      // and the activity log — so letting any authenticated principal POST here
+      // let a support client grant themselves access to any ticket by id.
+      // The /invite endpoint is unaffected: it writes with overrideAccess: true.
+      create: ({ req }) => req.user?.collection === slugs.users,
       update: () => false,
       delete: ({ req }) => req.user?.collection === slugs.users,
     },

package/src/collections/TicketMessages.ts

@@ -1,8 +1,8 @@
 import type { CollectionConfig, CollectionBeforeChangeHook, CollectionAfterChangeHook, Where } from 'payload'
+import { APIError } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import type { SupportCapabilities } from '../types'
 import { escapeHtml, emailWrapper, emailButton, emailQuote, emailParagraph, emailRichContent, emailTrackingPixel } from '../utils/emailTemplate'
-import { fireWebhooks } from '../utils/fireWebhooks'
 import { createAdminNotification } from '../utils/adminNotification'
 import { dispatchWebhook } from '../utils/webhookDispatcher'
 import { readSupportSettings } from '../utils/readSettings'
@@ -13,6 +13,41 @@ import { queueClientNotification } from '../utils/notificationQueue'
 import { sendPushToUser } from '../utils/push'
 import { dbFind, dbCreate, dbFindByID } from '../utils/db'
 
+/**
+ * Cross-tenant write guard for support-clients.
+ *
+ * `access.create` only checks WHICH collection the actor belongs to, so any
+ * authenticated support-client could POST a message onto an arbitrary ticket id.
+ * That is not just a data-integrity issue: the `afterChange` notification hooks
+ * would then mail the injected body to the real ticket owner from the legitimate
+ * support address (phishing over a trusted channel).
+ *
+ * We reuse `resolveAccessibleTicketIds()` — the same boundary `access.read` uses —
+ * so read and write scopes cannot drift apart. Staff writes and every internal
+ * `overrideAccess` write are untouched: they carry no `support-clients` user.
+ */
+function createRestrictClientTicketTarget(slugs: CollectionSlugs): CollectionBeforeChangeHook {
+  return async ({ data, operation, req, originalDoc }) => {
+    if (req.user?.collection !== slugs.supportClients) return data
+
+    const raw = (data as { ticket?: unknown }).ticket
+      ?? (operation === 'update' ? (originalDoc as { ticket?: unknown } | undefined)?.ticket : undefined)
+    const targetId = raw && typeof raw === 'object' ? (raw as { id?: unknown }).id : raw
+    if (targetId === undefined || targetId === null || targetId === '') {
+      throw new APIError('Ticket cible requis.', 400)
+    }
+
+    // 'write' scope: a collaborator invited as `viewer` may READ the thread but
+    // must not post into it — the invitation email promises exactly that, and a
+    // message from a viewer would fan out the whole notification chain.
+    const accessible = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id, 'write')
+    if (!accessible.some((id) => String(id) === String(targetId))) {
+      throw new APIError('Ticket inaccessible.', 403)
+    }
+    return data
+  }
+}
+
 function createAssignAuthor(slugs: CollectionSlugs): CollectionBeforeChangeHook {
   return async ({ data, operation, req }) => {
     if (operation === 'create' && req.user?.collection === slugs.supportClients) {
@@ -300,26 +335,12 @@ function createNotifyAdminOnClientMessage(slugs: CollectionSlugs, notificationSl
   }
 }
 
-function createFireMessageWebhooks(slugs: CollectionSlugs): CollectionAfterChangeHook {
-  return async ({ doc, operation, req }) => {
-    if (operation !== 'create') return doc
-    // Don't fire for scheduled messages that haven't been sent yet
-    if (doc.scheduledAt && !doc.scheduledSent) return doc
-    // Don't fire for internal notes
-    if (doc.isInternal) return doc
-
-    const ticketId = typeof doc.ticket === 'object' ? doc.ticket.id : doc.ticket
-    fireWebhooks(req.payload, slugs, 'ticket_replied', {
-      ticketId,
-      messageId: doc.id,
-      authorType: doc.authorType,
-      body: doc.body?.length > 500 ? doc.body.slice(0, 500) + '...' : doc.body,
-    })
-
-    return doc
-  }
-}
-
+/**
+ * Single outbound-webhook dispatcher for replies. See the matching comment in
+ * Tickets.ts: a second, unsigned dispatcher used to fire on this exact hook with
+ * the same guards, doubling every delivery. The `body` excerpt of the legacy
+ * payload is carried over so existing consumers do not regress.
+ */
 function createDispatchWebhookOnReply(slugs: CollectionSlugs): CollectionAfterChangeHook {
   return async ({ doc, operation, req }) => {
     if (operation !== 'create') return doc
@@ -328,7 +349,12 @@ function createDispatchWebhookOnReply(slugs: CollectionSlugs): CollectionAfterCh
 
     const ticketId = typeof doc.ticket === 'object' ? doc.ticket.id : doc.ticket
     dispatchWebhook(
-      { ticketId, messageId: doc.id, authorType: doc.authorType },
+      {
+        ticketId,
+        messageId: doc.id,
+        authorType: doc.authorType,
+        body: doc.body?.length > 500 ? doc.body.slice(0, 500) + '...' : doc.body,
+      },
       'ticket_replied',
       req.payload,
       slugs,
@@ -534,7 +560,7 @@ export function createTicketMessagesCollection(slugs: CollectionSlugs, options?:
       ] : []),
     ],
     hooks: {
-      beforeChange: [createSanitizeMessageHtml(), createResolveMentions(slugs), createAssignAuthor(slugs)],
+      beforeChange: [createRestrictClientTicketTarget(slugs), createSanitizeMessageHtml(), createResolveMentions(slugs), createAssignAuthor(slugs)],
       afterChange: [
         ...(options?.capabilities?.sms ? [createSmsNotification(slugs, options.capabilities.sms)] : []),
         createAutoUpdateStatus(slugs),
@@ -543,7 +569,6 @@ export function createTicketMessagesCollection(slugs: CollectionSlugs, options?:
         createCheckSlaOnReply(slugs, notificationSlug),
         createSyncTicketReplyToChat(slugs),
         createNotifyAdminOnClientMessage(slugs, notificationSlug),
-        createFireMessageWebhooks(slugs),
         createDispatchWebhookOnReply(slugs),
         createNotifyMentions(slugs),
         ...(options?.capabilities?.threadCleanup ? [createThreadCleanup(options.capabilities.threadCleanup)] : []),